Keldyn MCP server

​

Find your MCP URL

https://mcp.keldyn.ai/

​

Prerequisites

• Keldyn account — You sign in with your normal Keldyn credentials in the browser during the OAuth flow.
• Team membership — You must belong to at least one team. You’ll pick a team during sign-in, and every request is scoped to it.
• Team admin (for some tools) — Listing integration-collected control evidence (list-control-evidence) and all Trust Center management tools (*-trust-center-*) require a team-admin (or owner) token.
• Supported AI tool — Any client that supports remote MCP servers with OAuth, including Claude Code, Cursor, VS Code, and Codex.

​

Claude Code

claude mcp add --transport http keldyn https://mcp.keldyn.ai/

​

Add to Cursor

{
  "mcpServers": {
    "keldyn": {
      "url": "https://mcp.keldyn.ai/"
    }
  }
}

​

Other MCP-compatible clients

• Server URL — https://mcp.keldyn.ai/. See Find your MCP URL.
• Authentication — OAuth. Sign in as a Keldyn user and pick a team when the browser flow opens.

​

How authentication works

​

What your AI agents can do with Keldyn MCP

​

Frameworks & use cases

• list-frameworks — Browse compliance/security frameworks (scope to a use case, the org, or all frameworks).
• list-use-cases — List use cases for your team, with pagination and filters (search, status, risk level, business area, owner).
• get-use-case — Fetch a single use case, including its frameworks and details.
• update-use-case-architecture — Create or update a use case’s Threagile architecture model.
• analyze-use-case-architecture — Run or fetch Threagile security analysis plus RCM architecture compliance checks for a use case, returning a unified, severity-sorted, paginated list of fixable issues.
• update-risk-tracking — Record a disposition (mitigated, accepted, false-positive, in-progress, in-discussion) for a single Threagile security risk, with who/why.

​

Controls, tracking & evidence

• list-controls — List RCM controls across use-case and org scopes, each with implementation status and a human-readable status label.
• get-control — Fetch a single control by rcmId with all API fields plus its tracking entry (status, evidence text, assignee, finding, timestamps).
• update-control — Update a control’s implementation tracking (todo, in_progress, complete, ignored) and optionally set evidence text, assignee, or a finding.
• list-control-links — List audits, measures, obligations, or documents linked to a control.
• list-control-evidence — List integration-collected (automated) control evidence with freshness/status. (Requires a team-admin token.)
• list-evidences / get-evidence — Browse and fetch manual measure evidence (files and links).

​

Audits

• list-audits / get-audit — List audits for the organization and fetch a single audit.
• list-audit-controls — List the controls in scope for an audit.

​

GRC entities

• list-entities / get-entity — Access risks, measures, obligations, findings, tasks, and data records.
• list-entity-links — Traverse links between entities (e.g. risks → measures, obligations → controls).

​

Knowledgebase

• search-knowledge — Hybrid search over the index. Returns cited passages, not a drafted answer.
• answer-knowledge — Same retrieval with neighbouring context and grounding instructions so your agent drafts a cited answer itself.
• list-knowledge-tree / fetch-knowledge-document / fetch-document-section / fetch-knowledge-source — Browse the index as folders, open a file by path, read one section at a time, or inspect a connector’s sync status.
• create-knowledge-document — Write a manual entry the same way New file does in the index browser.

​

Tasks

• list-tasks / get-task — List and fetch organization tasks, filtered by measure, state, priority, or search.
• create-task / update-task / delete-task — Full task CRUD; link a task to the control it addresses with rcmId.

​

Trust Center

• get-trust-center-status / update-trust-center-status — Check whether the public Trust Center is enabled (with its slug and public URL) and turn it on or off.
• get-trust-center-profile / update-trust-center-profile — Read and update branding and contact settings (summary, primary color, contact email, privacy policy link, controls-updated badge). Image assets are uploaded from the web app.
• list-trust-center-frameworks / update-trust-center-frameworks — List assigned frameworks with their publish settings and publish/unpublish badges, including planned/achieved status and target quarter/year.
• list-trust-center-controls / set-trust-center-control-sharing — List your controls grouped by framework with their public sharing state, and show or hide an individual control on the public page.
• list-trust-center-resources / update-trust-center-resource / delete-trust-center-resource — Manage the published document library (title, description, framework tag, label, published state, and public vs. access-gated visibility). New file uploads are done from the web app.
• list-trust-center-domains — List configured custom domains and their verification status (read-only; domains are added and verified in the web app).
• list-trust-center-access-requests / grant-trust-center-access-request / deny-trust-center-access-request — Review visitor requests for gated resources and approve or decline them. Approving emails the requester a 45-day access link; declining notifies them.
• list-trust-center-access-grants / deactivate-trust-center-access-grant — List issued access links and revoke one immediately.
• get-public-trust-center — Preview the full public payload (branding, published frameworks, shared controls, resources, subprocessors) for a slug, domain, or organization.

​

Built-in workflows (prompts)

• review-changes — Review your code changes against the org’s Keldyn controls.
• review-codebase — Review the whole codebase (or a scoped path/package) against controls.
• start-dev — Prime the agent with developer guidance from applicable controls.
• generate-architecture — Infer a Threagile architecture from your codebase and save it to a use case.
• collect-evidence — Scan your codebase for positive evidence that code-related controls are satisfied, then confirm before saving.
• remediate-insufficient-evidence — Find controls whose evidence failed acceptance criteria and gather stronger file-backed proof.
• search-org-context — Search Knowledgebase with the team’s real sources listed up front, and refuse to answer from general knowledge.

​

Resources